top | item 6044619

19-year-old hacker reveals how he rigged voting machines and election in Brazil

91 points| luizgrp | 12 years ago |translate.google.com | reply

45 comments

order
[+] aylons|12 years ago|reply
His allegations are easily disprovable or provable.

Every eletronic ballot in Brazil prints the vote count for each candidate before leaving the voting room. Several copies of this report are printed, every citizen may ask for each and political parties often do it. I do it for the ballot I vote.

However, he claims to tamper the results after that, during the data consolidation process, when data from every ballot is summed. So, to prove him right, it is only a matter of checking if the ends meet.

Apparently, they meet. No political party has ever contested the results based on this difference.

Not to say Brazilian voting system is infallible - there are many problem with it. But this is not one.

[+] personlurking|12 years ago|reply
"Apparently, they meet." What makes you say that, if I may ask?

I noticed Globo/Folha/et al haven't reported on this despite it having been revealed in December of last year.

___

On a side note...

Anyone who speaks Portuguese, I recommend the documentary "Vocação do Poder", that follows 6 electorial candidates in Rio while on the campaign trail. http://www.youtube.com/watch?v=vI8_oz6lsbE

For those who don't speak Portuguese, search out the documentary "Send a Bullet" which looks at crime and fraud in Brazil.

[+] cturner|12 years ago|reply
Hey - I had an idea for how electronic voting could work.

Voters would enter their vote into a computer. The computer would print out a card for you, and show it to you from behind a perspex card. You would then say "OK" to verify that it was correct and it would drop into a box.

Now there'd be a physical copy of the cards. These could be counted and checked by scrutineers as the current electoral process works. They would need to do a manual count independent of the electronic count, and the judiciary could oversee a wrap-up ceremony where the two were compared for correctness.

In order to rig a vote and get away with it, you'd need to hack both the computer system and the manual count. Chavez could do it, but joe random hacker definitely couldn't.

But you'd get a fast, clear result for television purposes. Voting cards would not be ambiguously filled in the way they are now. And if you had a compulsory preferential system, as in some jurisdictions now, you could cause the software to enforce that in a way that isn't possible with manual entry at the moment.

[+] a-priori|12 years ago|reply
Or you could do it all by paper. I hate to sound like a luddite here, but there's simply no place for electronics in the electoral process.

Paper is excellent for ballots. It's easy to understand (put a mark next to whoever you want to elect). It's easy to collect (put ballot in a box). It's easy to count (have multiple people look at ballot, tally result). It's easy to secure (seal the boxes, keep them in a secure location). It's easy to verify (unseal the boxes, count again). It's tamper evident (examine ballots closely). You can ensure that the whole process is fair by having observers physically present each step of the process watching for shenanigans.

The only downside is that it's labour-intensive. But really, that's minor. Accept that as the cost of being confident in the election results. There are fewer things more important in a democratic society than free and fair elections.

[+] flomincucci|12 years ago|reply
I actually work in a company that has a similar voting system. We print out a card, and we also burn the content of the vote in a rfid chip, that voters can check themselves. The rfid speeds up the counting, but you can always do the manual count to check up with the system. Neither the machine nor the card contain any information that can identify the person, so we can preserve the anonimity. Perhaps you can check out our site :) http://www.vot-ar.com.ar/en/system-votation/
[+] gamegoblin|12 years ago|reply
I don't know about other voting machines, but the ones here in Northwest Arkansas had a receipt of your vote behind plexiglass that you could watch print out as you made your selections. Pretty similar to what you suggest, except that I don't believe they use the paper for anything unless their is worry of fraud.
[+] IanMalcolm|12 years ago|reply
I worked in the last elections in Brazil.

Every machine (which is never online) prints a sum of all votes at the end of the day, and several copies are given out to those who are working the poll site.

So there is a hard copy of the votes, and anyone can check.

[+] dudus|12 years ago|reply
This seem like a lot more complicated and expensive.

Why not just give the voter a unique hashed password that he can enter the internet and verify the vote that was computed for that password. Then the voters are the ones that will verify the election.

[+] IanMalcolm|12 years ago|reply
This is old - and unverified - news.

This has been posted verbatim in several places already.

http://www.lucaspeperaio.com.br/blog/hacker-de-19-anos-conta... http://www.pragmatismopolitico.com.br/2012/12/hacker-fraude-... http://www.tecmundo.com.br/brasil/34010-em-evento-no-rj-hack... http://jornalistaflavioazevedo.blogspot.com.br/2013/01/hacke...

All from blogs. Not a single major news source.

This is, most likely, complete bullshit.

[+] ramon|12 years ago|reply
I agree totally its not real!
[+] diego_moita|12 years ago|reply
The real issue here is not if voting machines are the perfect solution, it is about what is the better solution. And if anyone knows voter fraud in Brazil, these machines are a lot better than the manual system. At least it demands the people committing the fraud to be a lot smarter than they used to be in manual counting.
[+] jeltz|12 years ago|reply
What kind of fraud was committed with the manual counting? Here in Sweden I would be more worried about electronic voting than the current manual counting, but social pressures vary across cultures.

EDIT: There have been both allegations and convictions of election fraud in Sweden, but never anything related to the counting of votes.

[+] DaviNunes|12 years ago|reply
Secureness of Brazilian voting system has been contested many times.

There are "The Alagoas case" which the candidate Joao Lyra requested a recount because he found out 1/3 of the ballots contained incorrect data and then asked for an audit, the court demanded 2 million for this audition, Joao Lyra then asked the the court itself to pay for it, since it would be in its interest to demonstrate the fairness of the process, the court refused to pay and even condemned the candidate for "bad faith litigation" for asking for an investigation and not paying for it(despite showing inconsistent ballot data).

It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports. We have no way to tell if our votes has been correctly collected nor the political parties that the votes were correctly summed, thus impossible to make a recount. In a voting system where you are not sure on whom your vote was recorded and the Election Court goes against political parties that accuse it, IMHO thats a true threat to democracy.

For a safer election it must include a voter-verified paper audit trail, a VVPAT allows voters the possibility to verify that their votes are cast as intended and can serve as an additional barrier to changing or destroying votes.

German and Holland Court already banned this first generation eletronic ballot box for not being secure enough, and Brazil is the only country on the world who still uses it.

[+] aylons|12 years ago|reply
> It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports

Yes, there is: you can check the electronic records online and compare it against the printed reports.

The other allegations are surely important to the voting transparency discussion, but are not related to the allegations on the OP.

[+] speeder|12 years ago|reply
There is newer.cases, like a guy that took his family.to vote.for him, and claims he voted.on himself.and still.ended with zero.votes. He sued.TSE but the reply was that he probably typed wrong and confirmed.a.wrong person.

Since there is no per vote paper ballot, it.is.his.word.against the judge word, so guess who win.

[+] ramon|12 years ago|reply
I think this is bull*, where are the logs? How did he manipulate the results? Did he use a API Call? From a packet interception? If then how? at what time?.. Did he call the application or the database? What's the server call in? Is it Webservice? You know.. It's a lot more questions than answers.. I think we need real proof of what the heck is going on before we assume this is real, he needs to be the ultimate master of manipulation in order for noone to have seen this since there are so many people comparing the printed results versus the final one...
[+] rslonik|12 years ago|reply
It was so much better when politics & conspiratorial stuff was only Reddit's business.
[+] sanoli|12 years ago|reply
There used to be a separate printer attached to the voting machines, which would print each individual vote, in the presence of the voter, and would automatically go into a ballot, and it would be used in case there was an allegation of fraud. They of course did the dumb thing and did away with the printer, now they only have printouts of the total votes after the session is done and the machines are about to leave the place. From Wikipedia: "The 2002 version had a printer module that printed each vote, but the printed vote was abandond after Law 10.740/2003 and should only be reintroduced in 2014, according to Article 5 of Law 12.034/2009"
[+] ramon|12 years ago|reply
This is because vote buyers would ask for the receipt after the vote is concluded, to prevent this they do a unified printing.
[+] swah|12 years ago|reply
Interesting how the "TRE" (entity responsible for the voting process) keeps stating the system is safe.
[+] jturolla|12 years ago|reply
Interesting how people believe in completely random and untrusted sources.
[+] chewit|12 years ago|reply
Well what else would you expect them to be saying?
[+] ttty|12 years ago|reply
They should put a public list of names and whom they voted for... Crystal clear and no doubts...
[+] aylons|12 years ago|reply
And perfect for manipulation and black-mailing.